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Remarks 

In the Office Action dated December 20, 2004, the Examiner rejected claim 18 
under 35 U.S.C. § 112, second paragraph. The Examiner rejected claims 1-33 under 35 
U.S.C. § 102 as being anticipated by the U.S. Patent to Belissent 6,789,203. 

Briefly, as noted in the Background Art portion of the application, it is well 
known to avoid denial of service attacks by employing various types of packet filtering 
techniques in the form of firewalls. However, as noted on page 4, lines 7-17, potential 
firewall solutions have a number of drawbacks. Also, as noted on page 5, lines 6-9, 
identifying the characteristics related to denial of service attacks can be impractical because of 
voluminous amount of information associated with the characteristics. 

The U.S. Patent to Belissent 6,789,203 notes in its background section and, in 
particular, with reference to its Figure 1, that a firewall may be utilized in a conventional 
approach (column 2, lines 23-29) to defend against denial of service attacks by monitoring 
connection requests from a particular client which, if higher than a predetermined threshold, 
identifies the requesting client as an attacker. As noted at column 4, lines 9-20, Belissent's 
invention as described therein is an IP throttler which records all connecting IP addresses 
thereby allowing the server to detect attackers as soon as the volume of the connection requests 
coming from a particular IP address is higher than would otherwise be expected. 

By contrast, the invention of amended claim 1 calls for a collector, which is 
adapted to receive a plurality of data packet flow statistics from a routing system of a computer 
network. As noted on page 13, line 26 through page 14, line 12, the data packet flow statistics 
may be generated by data packet flow statistical software. As noted at page 14, lines 8-12, 
such statistical information can include: the number of packets which have been communicated 
between computer systems. The duration of the communication between each of the computer 
systems; and the total number of packets communicated over each local area network as well 
as other various data packet flow statistical information. Clearly, Belissent does not disclose 
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a collector adapted to receive such statistics from a routing system of a computer network as 
only provided by the present invention. 

Furthermore, claim 1 calls for the collector to process the data packet flow 
statistics to detect one or more data pocket flow anomalies and to generate a signal representing 
the one or more data packet flow anomalies. Again, Belissent determines a connection request 
rate, which as noted in Figure 1 of Belissent and the corresponding description, is prior art to 
Belissent. Belissent simply fails to detect one or more data pocket flow anomalies to generate 
a signal representing the one or more data pocket flow anomalies based on processed data 
packet flow statistics. 

Furthermore, as claimed in claim 1 , the controller is provided to respond to the 
signal generated by the collector by tracking attributes related to the one or more data packet 
flow anomalies to at least one source. Belissent simply fails to disclose tracking attributes 
related to the one or more data pocket flow anomalies to a source. 

The comments relating to independent claim 1 are also applicable to independent 

claim 27. 

With respect to independent claim 19, independent claim 19 requires at least one 
routing system and means for detecting one or more denial of service attacks communicated 
to a plurality of computer systems over the at least one routing system based on data packet 
flow statistics. Clearly, Belissent fails to disclose this feature. 
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Consequently, in view of the above and in the absence of better art, Applicants' 



Attorney respectfully submits the application is in condition for allowance, which allowance 
is respectfully requested. 



Date: February 9, 2005 
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